440837ebce0aefbb0817c0bc6b1896170e76be42d20759afaeb5d764d2be6315

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2025 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
Size

99KB
MD5

fffd99e8fbb30cc91081b6ec0a6b98c7
SHA1

908801e3ab0813010b3d7f427a2d9d2ec21d38a8
SHA256

440837ebce0aefbb0817c0bc6b1896170e76be42d20759afaeb5d764d2be6315
SHA512

0a21e16ea954bf8e193d4d4e7dd2058947ab575e949ba2c3c3d92eaa0491d7277a64e28bcb7633f88e49b28cf07ce3ed8362a3a818c50585c2234ab35f89cf3b
SSDEEP

3072:0gpodXhXUodXhthvj8GnpI7MMj2M8cmC24gDtsr:Kj8QpI7MMj2M8cmC24Dr

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
134	3260	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2244	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1172	msedge.exe
1172	msedge.exe
2112	identity_helper.exe
2112	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1604	1172	msedge.exe	89
PID 1172 wrote to memory of 1604	1172	msedge.exe	89
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 3932	1172	msedge.exe	90
PID 1172 wrote to memory of 1744	1172	msedge.exe	91
PID 1172 wrote to memory of 1744	1172	msedge.exe	91
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92
PID 1172 wrote to memory of 4876	1172	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ff9aaf446f8,0x7ff9aaf44708,0x7ff9aaf44718
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14932593691671018807,14288385701606100743,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDlBMUMzNkUtRUQ2OC00REFBLTg2Q0YtQkZCNjBDNzg3MUUwfSIgdXNlcmlkPSJ7RDRGNDEyQTctNzkzMi00MjNBLUEyOTgtM0ZBNTI2REVGN0ZFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RkJDQkU2ODAtQTdGMS00REUxLTg2MEUtRkQxNzZGNjM2N0JCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTcwMjA4OTAwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e7cdb863a609a2c77150bd0168843b66

SHA1
81f66ff335d38ce1985e57650c45c92a780f5f47

SHA256
cae95bfcebfe3738b20d2502a4e8252b7cb44b699f219e4050043e2ce5e50700

SHA512
f4bfd5280f196266ed021e30bdd29ec9013a5ce73f5737fdae5d8a296a6a669296370c7405e9778144dd745ae53d3143de8de23967984828870eaf318d74e9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99a53beb5abd659549f1af758f31cd5c

SHA1
1b91526d8dd19cbe0c572207bd99e47e9b6bfdbc

SHA256
c0605e1d61f7a80a5b7a13f151bb4b90a330ccd0b3a436a9aa9d5e6d11b1334e

SHA512
e798e3d8a716acd1356882caf3012a2d65570e4eb5cf34df4459747851dfe75aa04b4de27217e88baa46d69e2e1ac40be6d8167e4f8857788365bc9c10428f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
2ebfdbd309ee762211b4a2ac39708c4d

SHA1
b002922c672dbe1dd4caa02af24d0b1e7da616af

SHA256
54ae97d445b166859fe3ba6241b97abbac0aa0d158c72352b774d60ba3e81797

SHA512
d1687b7a6da07a72963c96a1e85661046d3d3c96f88445302afa09721fbe211a5fb8881ff14b346b0ebe8a20f5ced21979e9f58e256427e57b85d565bef17720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ea2b25b2087c3dc5486dd5ffa93d01ef

SHA1
f70f507607ad3a317715eee17cd50fa1e0387900

SHA256
c7ca2f90eca6d2f74fd80e17d541345a9169bcaedadb5f264b722fe95b9b703d

SHA512
0ca039f3521017f3d8f259ffcdc98f6ce86601478212f149b3872aaaee9fa74fe23d6176a02c60cfbcb06040e13089d8a7f255fe39db451d54058953bba08115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
30945c0c1fdfce6c707b45e8f9f5e98f

SHA1
4c9590d3274f2b45cf7f5d6e61c4aaafca4baf9b

SHA256
7493f2da0f3992a3a54f25514345c6617fe48753b8357244b2273aac6df84494

SHA512
e66d33b8c024b754ed9f8255309da20ea27877aa68929a564eb7b2db2c16bcd3791a65b0322a142f6c22664463eec40037911da2cfee4a7d38744d600adacd6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
faa4559dd797b8180621619750f35ce4

SHA1
e959f818ef86e2a67b7fa56d9e083204522d5ad1

SHA256
911528e2ebd2f7a029a40806f20bab55c15050804eb28eb267de9010a1e43047

SHA512
a76bcdefe6e6dc08dfa6140ba69bee8f12a494a6d07a61d5561ee07ef69591cc45ba1b0cc8cb31d38900c600b023ec26ac60ce4c7bbb50937b1f4e2abde70058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ebf92e860e9e16ed3c29a6b66e2a496f

SHA1
820adeb71f19ef549a03ad15674650b957e4b063

SHA256
77f7d141b0b3a54aa89dad0db80a05df619c1639e28307a79442a94033b80ffe

SHA512
8dde58276f463b26ee955f314f1e763906311b66b78a42f2e9cb204f680e689766c62ac24bba079236a6359b7c64203defd65b4487676f11e2edcb8f62990f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f6bd3a32a049a8f8b198ad6a5a5cc82

SHA1
46438b85c1b4702fb49e33aeb5672bf2e90d0339

SHA256
be6c295d7f61c2bad5f8d2d78e45be262b67ae54914d376712cab0152b02a062

SHA512
df4377a6a0df8af54b37b15a005bf03a4422b5edc2433b95ef605889cc2fc40b514d3cdfe52ccd1251630d54a46cfbef3d4aaac4f4d4275d26e1ffc76338387d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a67f15b2c80a9a7f911ba0c1ea45d209

SHA1
589cfb9c8681e44e57688829814b49ee68f72b4d

SHA256
49747433474d20462da32a6b390babee5339711e1d3951ef0e5a17c79cd1de66

SHA512
34513328e8c66549f3d5438f3a531e49c3523c0d7fff04191d171b430602b27aeb27d3041d9e63af0585cf95cb16ba6632955a51647bca17a294767db4c1bcd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc60b83ea56d03e87704ddde433e52ba

SHA1
94ba48760511e690f9eda9a10d662f7a1431291c

SHA256
fa16846006840faa5a7da5735f6362d0d5b58498391f417de828bdbb5940977d

SHA512
191e9604da7c23fec3e7a734a646ff2159c5625544d4091e80e6b739cf15e3a3ade0d9f447991da3fb21590e0e1acc36f1a0fe83892f342a28516cdadf76371a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
04966fda0d75dcd0ae1c82fe6cf19eb3

SHA1
e90783dd3b35b201246ddd6d306b9bdb9f30b2da

SHA256
d649ce67b8988070b8f4a7fb5835fc6673b6181bdfd1788da09a56c8f6463ce1

SHA512
57f272baa54cfc97e99faa460aaabcf37e7e5b8e3317732ab02e12fa6001cdd11958583b78c3769dfb3d12b2c82ce0713accbe204df522a062e54651ae64a8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd1c65dacdb2911a94ae0f85811ce078

SHA1
d65ceb13e17eb5623d9a0888d315537e4e1a9a43

SHA256
6e29068e9753e8f83378e51ba23a9f0db3abc892c47c351304dcffd22001e218

SHA512
4f8a290b9791d532e06f0ab381b4bd9d0915e8ccf8659f78a54f5deab120d8bb6baf349c4d7c9a00909952827c7ef362e3aa76b679eeb8da354302fbb656af96

Download Submit